FA-26439 / HTTP ranges / Member archive

Unauthorized range probes hide whether the object exists · case 04

Unauthorized range probes hide whether the object exists.

Member previewVariant 4 · 3 implementations · 6 checks per implementation

Case contract

Local concealment policy returns [403,empty] for unauthorized users before object existence; authorized absent objects return 404, present objects 206.

Why this case matters

Range responses combine representation identity, conditional requests, framing, and partial-object state.

One recorded failure

Sample boundary fixture

This sample comes from the broken implementation of a controlled reproducer.

Boundary fixture	Actual	Expected	Outcome
authorization-before-object-existence fixture 0	`[404, ""]`	`[403, ""]`	Failed

MEMBER ARCHIVE

The complete case is available to members.

This record includes three runnable implementations, regression fixtures, execution results, and source hashes.

Member access is invitation-based. Sign in with your invited account to inspect the sources.